Instagram ads used to deliver Coruna and DarkSword to iPhones
Original title: Hackers Use Instagram Ads to Deploy Coruna and DarkSword Spyware on iPhones
The DeadTag operation also abuses expired analytics domains referenced by sites that together draw about 135 million monthly visits.
Researchers say criminal operators used malicious Instagram ads, abandoned analytics tags, and compromised websites to deliver the Coruna and DarkSword exploit kits to vulnerable iPhones. Report URI’s DeadTag operation buys expired advertising and analytics domains still referenced by forgotten script tags, then selectively routes qualifying iPhones to the kits. iVerify saw a DarkSword P7 variant reach an employee through a World Cup-themed Instagram ad. Observed payloads targeted keychain passwords, accounts, and cryptocurrency wallets. Attempts aimed at iOS 26 and 27 were described as largely nonfunctional.
Unconfirmed: How the ad passed Meta’s screening, DeadTag’s operators, and confirmed infection counts are not established.
- Exploitation can start when a malicious page or ad loads, in so-called half-click attacks.
- Hundreds of abused domains were embedded across thousands of websites.
- Attackers also hid DarkSword loaders in hundreds of compromised PrestaShop stores.
- A fraudulent Polymarket page delivered both Coruna and P7 DarkSword to one server.
- Chinese-language comments suggest a financially motivated operation, not proven state sponsorship.
Impact: Steal keychain passwords, accounts, and cryptocurrency wallet data
- 1.Remove obsolete third-party script tags and enforce a restrictive Content Security Policy.
- 2.Install current iPhone security updates; higher-risk users can consider Lockdown Mode.
- 3.Preserve forensic evidence and rotate exposed credentials after suspected compromise.
- Organizations
- iVerifyReport URI
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ad-track.live | ough a World Cup-themed Instagram advertisement served from ad-track[.]live. Once attackers acquire a domain, those existing integrat |
From the original article
2 min read at gbhackers.com
Cybercriminal groups are using malicious Instagram advertisements, abandoned analytics tags, and compromised websites to deliver Coruna and DarkSword exploit kits to vulnerable iPhones. The investigation exposes a scalable spyware distribution model in which attackers exploit advertising infrastructure to reach victims during ordinary browsing.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.